Skip to content

deps(v4)(deps): bump pkcs8 from 0.10.2 to 0.11.0 in /v4#266

Closed
dependabot[bot] wants to merge 1 commit into
v4from
dependabot/cargo/v4/v4/pkcs8-0.11.0
Closed

deps(v4)(deps): bump pkcs8 from 0.10.2 to 0.11.0 in /v4#266
dependabot[bot] wants to merge 1 commit into
v4from
dependabot/cargo/v4/v4/pkcs8-0.11.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps pkcs8 from 0.10.2 to 0.11.0.

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file rust Pull requests that update rust code labels Apr 30, 2026
pacphi added a commit that referenced this pull request Apr 30, 2026
@pacphi @ruvnet
deps(v4): bump fs4 1.1, hkdf 0.13, rand 0.9, jsonschema 0.46, oci-spe…
c0427e6 
…c 0.9

Applies dependabot PRs #267, #268, #270, #271, #273:

- oci-spec 0.7 → 0.9
- fs4 0.12 → 1.1 (sindri-core, sindri-registry); switched apply_state and
  git_cache to std::fs::File lock APIs (stable in Rust 1.89), dropping the
  fs4 import in those modules
- hkdf 0.12 → 0.13; replaced sha2_v10 (sha2 0.10) with workspace sha2 0.11
- rand 0.8 → 0.9 in sindri-secrets; thread_rng() → rng()
- jsonschema 0.29 → 0.46 (schema-gen dev-dep)

Skipped (require coordinated upgrades, not yet actionable):

- pkcs8 0.10 → 0.11 (PR #266): blocked by x509-cert 0.2 / sigstore 0.13
  pin — der 0.7 vs 0.8 trait mismatch
- rand_core 0.6 → 0.9 (PR #269): blocked by p256 0.13 SigningKey::random
  CryptoRngCore bound on rand_core 0.6
- rcgen 0.13 → 0.14 (PR #272): test cert synthesis API changed
  (signed_by signature, KeyUsagePurpose); needs test rewrite

Co-Authored-By: claude-flow <ruv@ruv.net>
@dependabot dependabot Bot force-pushed the dependabot/cargo/v4/v4/pkcs8-0.11.0 branch from 56d2e14 to 60058aa Compare April 30, 2026 13:50
@dependabot
deps(v4)(deps): bump pkcs8 from 0.10.2 to 0.11.0 in /v4
0e30c13 
Bumps [pkcs8](https://github.com/RustCrypto/formats) from 0.10.2 to 0.11.0.
- [Commits](RustCrypto/formats@pkcs8/v0.10.2...pkcs8/v0.11.0)

---
updated-dependencies:
- dependency-name: pkcs8
  dependency-version: 0.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/cargo/v4/v4/pkcs8-0.11.0 branch from 60058aa to 0e30c13 Compare April 30, 2026 13:59
@pacphi

pacphi commented Apr 30, 2026

Copy link
Copy Markdown
Owner

Blocked on upstream coordinated upgrade — not actionable today.

pkcs8 0.11 uses der 0.8, but sigstore 0.13 vendors x509-cert 0.2 which uses der 0.7. Bumping pkcs8 alone breaks Certificate::from_der, OctetString::to_der, and related trait bounds in sindri-registry::keyless.

cargo update -p pkcs8 --precise 0.11.0 is rejected by sigstore 0.13's transitive pkcs8 = "^0.10" constraint.

The fix requires either:

  • waiting for sigstore 0.14 to ship with bumped crypto deps, or
  • pulling pre-release crates (x509-cert 0.3.0-rc.4, p256 0.14.0-rc.9, ecdsa 0.17.0-rc.18) — too risky for a release codebase.

Leaving open until sigstore 0.14 / x509-cert 0.3 stable is available.

@pacphi pacphi mentioned this pull request Apr 30, 2026
Closed
@pacphi pacphi mentioned this pull request May 13, 2026
Merged
5 tasks
@dependabot @github

dependabot Bot commented on behalf of github May 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like pkcs8 is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this May 14, 2026
@dependabot dependabot Bot deleted the dependabot/cargo/v4/v4/pkcs8-0.11.0 branch May 14, 2026 17:10
@pacphi Claude

pacphi commented Jun 11, 2026

Copy link
Copy Markdown
Owner

Status check 2026-06-11 (revisit of blocked dependabot PRs)

The direct goal of this PR — pkcs8 0.10 → 0.11 — was resolved: v4/Cargo.toml already carries pkcs8 = "0.11", which is why dependabot auto-closed this. The broader coordinated crypto-stack upgrade (the underlying blocker at the time) remains partially blocked:

Crate Latest stable Status
sigstore 0.14.0 ✅ Now stable — PR #332 is open for this upgrade
pkcs8 0.11.0 ✅ Already applied to v4
rand_core 0.10.1 ✅ Stable (note: latest is 0.10.1, not 0.9.x)
p256 0.14.0-rc.11 ⏳ Still pre-release
ecdsa 0.17.0-rc.19 ⏳ Still pre-release
x509-cert 0.3.0-rc.4 ⏳ Still pre-release

The full coordinated upgrade of sigstore + p256 + ecdsa + x509-cert requires p256 0.14 stable. Re-checking in 6 weeks.

Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file rust Pull requests that update rust code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pacphi